SurrealDB re-checks the password against its slow hash on every request. The token from /signin is kept in the
isolate's memory and in KV until 10 min before it expires, replaced if refused, and the password is still used if
no token can be had.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
